协议端点 (Protocol Endpoints) _ Spring Authorization Server 1.2.5 中文文档(官方文档中文翻译) —

对于最新的稳定版本，请使用 Spring Authorization Server 1.3.1！Spring中文文档

OAuth2 授权端点

OAuth2AuthorizationEndpointConfigurer提供自定义 OAuth2 授权终结点的功能。它定义了扩展点，允许您自定义 OAuth2 授权请求的预处理、主处理和后处理逻辑。Spring中文文档

OAuth2AuthorizationEndpointConfigurer提供以下配置选项：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.authorizationEndpoint(authorizationEndpoint ->
			authorizationEndpoint
				.authorizationRequestConverter(authorizationRequestConverter)   (1)
				.authorizationRequestConverters(authorizationRequestConvertersConsumer) (2)
				.authenticationProvider(authenticationProvider) (3)
				.authenticationProviders(authenticationProvidersConsumer)   (4)
				.authorizationResponseHandler(authorizationResponseHandler) (5)
				.errorResponseHandler(errorResponseHandler) (6)
				.consentPage("/oauth2/v1/authorize")    (7)
		);

	return http.build();
}

1	`authorizationRequestConverter()`：将尝试从中提取 OAuth2 授权请求（或同意）时使用的（预处理器）添加到或的实例。`AuthenticationConverterHttpServletRequestOAuth2AuthorizationCodeRequestAuthenticationTokenOAuth2AuthorizationConsentAuthenticationToken`
2	`authorizationRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证或的（主处理器）。`AuthenticationProviderOAuth2AuthorizationCodeRequestAuthenticationTokenOAuth2AuthorizationConsentAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`authorizationResponseHandler()`：用于处理“已验证”并返回 OAuth2AuthorizationResponse 的（后处理器）。`AuthenticationSuccessHandlerOAuth2AuthorizationCodeRequestAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 OAuth2Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthorizationCodeRequestAuthenticationException`
7	`consentPage()`：自定义同意页面，用于将资源所有者重定向到授权请求流期间是否需要同意。`URI`

OAuth2AuthorizationEndpointConfigurer配置并将其注册到 OAuth2 授权服务器。是处理 OAuth2 授权请求（和同意）的。OAuth2AuthorizationEndpointFilterSecurityFilterChain@BeanOAuth2AuthorizationEndpointFilterFilterSpring中文文档

OAuth2AuthorizationEndpointFilter配置了以下默认值：Spring中文文档

AuthenticationConverter— A 由和组成。DelegatingAuthenticationConverterOAuth2AuthorizationCodeRequestAuthenticationConverterOAuth2AuthorizationConsentAuthenticationConverterSpring中文文档
AuthenticationManager— 由和组成。AuthenticationManagerOAuth2AuthorizationCodeRequestAuthenticationProviderOAuth2AuthorizationConsentAuthenticationProviderSpring中文文档
AuthenticationSuccessHandler— 处理“authenticated”并返回 .OAuth2AuthorizationCodeRequestAuthenticationTokenOAuth2AuthorizationResponseSpring中文文档
AuthenticationFailureHandler— 使用与关联的并返回响应的内部实现。OAuth2ErrorOAuth2AuthorizationCodeRequestAuthenticationExceptionOAuth2ErrorSpring中文文档

自定义授权请求验证

OAuth2AuthorizationCodeRequestAuthenticationValidator是用于验证授权代码授予中使用的特定 OAuth2 授权请求参数的默认验证程序。默认实现验证 and 参数。如果验证失败，则抛出 an。redirect_uriscopeOAuth2AuthorizationCodeRequestAuthenticationExceptionSpring中文文档

OAuth2AuthorizationCodeRequestAuthenticationProvider通过向提供类型为的自定义身份验证验证程序，提供覆盖默认授权请求验证的功能。Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext>setAuthenticationValidator()Spring中文文档

OAuth2AuthorizationCodeRequestAuthenticationContext保存，其中包含 OAuth2 授权请求参数。OAuth2AuthorizationCodeRequestAuthenticationToken

如果验证失败，身份验证验证程序必须抛出 .OAuth2AuthorizationCodeRequestAuthenticationException

在开发生命周期阶段，一个常见的用例是允许在参数中。localhostredirect_uriSpring中文文档

以下示例演示如何使用允许在参数中执行的自定义身份验证验证程序进行配置：OAuth2AuthorizationCodeRequestAuthenticationProviderlocalhostredirect_uriSpring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.authorizationEndpoint(authorizationEndpoint ->
			authorizationEndpoint
				.authenticationProviders(configureAuthenticationValidator())
		);

	return http.build();
}

private Consumer<List<AuthenticationProvider>> configureAuthenticationValidator() {
	return (authenticationProviders) ->
		authenticationProviders.forEach((authenticationProvider) -> {
			if (authenticationProvider instanceof OAuth2AuthorizationCodeRequestAuthenticationProvider) {
				Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext> authenticationValidator =
					// Override default redirect_uri validator
					new CustomRedirectUriValidator()
						// Reuse default scope validator
						.andThen(OAuth2AuthorizationCodeRequestAuthenticationValidator.DEFAULT_SCOPE_VALIDATOR);

				((OAuth2AuthorizationCodeRequestAuthenticationProvider) authenticationProvider)
					.setAuthenticationValidator(authenticationValidator);
			}
		});
}

static class CustomRedirectUriValidator implements Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext> {

	@Override
	public void accept(OAuth2AuthorizationCodeRequestAuthenticationContext authenticationContext) {
		OAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthentication =
			authenticationContext.getAuthentication();
		RegisteredClient registeredClient = authenticationContext.getRegisteredClient();
		String requestedRedirectUri = authorizationCodeRequestAuthentication.getRedirectUri();

		// Use exact string matching when comparing client redirect URIs against pre-registered URIs
		if (!registeredClient.getRedirectUris().contains(requestedRedirectUri)) {
			OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST);
			throw new OAuth2AuthorizationCodeRequestAuthenticationException(error, null);
		}
	}
}

1	`authorizationRequestConverter()`：将尝试从中提取 OAuth2 授权请求（或同意）时使用的（预处理器）添加到或的实例。`AuthenticationConverterHttpServletRequestOAuth2AuthorizationCodeRequestAuthenticationTokenOAuth2AuthorizationConsentAuthenticationToken`
2	`authorizationRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证或的（主处理器）。`AuthenticationProviderOAuth2AuthorizationCodeRequestAuthenticationTokenOAuth2AuthorizationConsentAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`authorizationResponseHandler()`：用于处理“已验证”并返回 OAuth2AuthorizationResponse 的（后处理器）。`AuthenticationSuccessHandlerOAuth2AuthorizationCodeRequestAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 OAuth2Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthorizationCodeRequestAuthenticationException`
7	`consentPage()`：自定义同意页面，用于将资源所有者重定向到授权请求流期间是否需要同意。`URI`

OAuth2AuthorizationCodeRequestAuthenticationContext保存，其中包含 OAuth2 授权请求参数。OAuth2AuthorizationCodeRequestAuthenticationToken

如果验证失败，身份验证验证程序必须抛出 .OAuth2AuthorizationCodeRequestAuthenticationException

OAuth2 设备授权端点

OAuth2DeviceAuthorizationEndpointConfigurer提供自定义 OAuth2 设备授权终结点的功能。它定义了扩展点，允许您自定义 OAuth2 设备授权请求的预处理、主处理和后处理逻辑。Spring中文文档

OAuth2DeviceAuthorizationEndpointConfigurer提供以下配置选项：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.deviceAuthorizationEndpoint(deviceAuthorizationEndpoint ->
			deviceAuthorizationEndpoint
				.deviceAuthorizationRequestConverter(deviceAuthorizationRequestConverter) (1)
				.deviceAuthorizationRequestConverters(deviceAuthorizationRequestConvertersConsumer) (2)
				.authenticationProvider(authenticationProvider) (3)
				.authenticationProviders(authenticationProvidersConsumer) (4)
				.deviceAuthorizationResponseHandler(deviceAuthorizationResponseHandler) (5)
				.errorResponseHandler(errorResponseHandler) (6)
				.verificationUri("/oauth2/v1/device_verification") (7)
		);

	return http.build();
}

1	`deviceAuthorizationRequestConverter()`：将尝试从中提取 OAuth2 设备授权请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOAuth2DeviceAuthorizationRequestAuthenticationToken`
2	`deviceAuthorizationRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOAuth2DeviceAuthorizationRequestAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`deviceAuthorizationResponseHandler()`：（后处理器）用于处理“已验证”并返回 OAuth2DeviceAuthorizationResponse。`AuthenticationSuccessHandlerOAuth2DeviceAuthorizationRequestAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 OAuth2Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`
7	`verificationUri()`：自定义最终用户验证页面，用于将资源所有者定向到辅助设备上的验证页面。`URI`

OAuth2DeviceAuthorizationEndpointConfigurer配置并将其注册到 OAuth2 授权服务器。是处理 OAuth2 设备授权请求的。OAuth2DeviceAuthorizationEndpointFilterSecurityFilterChain@BeanOAuth2DeviceAuthorizationEndpointFilterFilterSpring中文文档

OAuth2DeviceAuthorizationEndpointFilter配置了以下默认值：Spring中文文档

AuthenticationConverter— 一个 .OAuth2DeviceAuthorizationRequestAuthenticationConverterSpring中文文档
AuthenticationManager— 由 .AuthenticationManagerOAuth2DeviceAuthorizationRequestAuthenticationProviderSpring中文文档
AuthenticationSuccessHandler— 处理“authenticated”并返回 .OAuth2DeviceAuthorizationRequestAuthenticationTokenOAuth2DeviceAuthorizationResponseSpring中文文档
AuthenticationFailureHandler— 一个 .OAuth2ErrorAuthenticationFailureHandlerSpring中文文档

1	`deviceAuthorizationRequestConverter()`：将尝试从中提取 OAuth2 设备授权请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOAuth2DeviceAuthorizationRequestAuthenticationToken`
2	`deviceAuthorizationRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOAuth2DeviceAuthorizationRequestAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`deviceAuthorizationResponseHandler()`：（后处理器）用于处理“已验证”并返回 OAuth2DeviceAuthorizationResponse。`AuthenticationSuccessHandlerOAuth2DeviceAuthorizationRequestAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 OAuth2Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`
7	`verificationUri()`：自定义最终用户验证页面，用于将资源所有者定向到辅助设备上的验证页面。`URI`

OAuth2 设备验证终结点

OAuth2DeviceVerificationEndpointConfigurer提供自定义 OAuth2 设备验证终结点（或“用户交互”）的功能。它定义了扩展点，允许您自定义 OAuth2 设备验证请求的预处理、主处理和后处理逻辑。Spring中文文档

OAuth2DeviceVerificationEndpointConfigurer提供以下配置选项：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.deviceVerificationEndpoint(deviceVerificationEndpoint ->
			deviceVerificationEndpoint
				.deviceVerificationRequestConverter(deviceVerificationRequestConverter) (1)
				.deviceVerificationRequestConverters(deviceVerificationRequestConvertersConsumer) (2)
				.authenticationProvider(authenticationProvider) (3)
				.authenticationProviders(authenticationProvidersConsumer) (4)
				.deviceVerificationResponseHandler(deviceVerificationResponseHandler) (5)
				.errorResponseHandler(errorResponseHandler) (6)
				.consentPage("/oauth2/v1/consent") (7)
		);

	return http.build();
}

1	`deviceVerificationRequestConverter()`：将尝试从中提取 OAuth2 设备验证请求（或同意）时使用的（预处理器）添加到或的实例中。`AuthenticationConverterHttpServletRequestOAuth2DeviceVerificationAuthenticationTokenOAuth2DeviceAuthorizationConsentAuthenticationToken`
2	`deviceVerificationRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证或的（主处理器）。`AuthenticationProviderOAuth2DeviceVerificationAuthenticationTokenOAuth2DeviceAuthorizationConsentAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`deviceVerificationResponseHandler()`：（后处理器）用于处理“经过身份验证”并指示资源所有者返回其设备。`AuthenticationSuccessHandlerOAuth2DeviceVerificationAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回错误响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`
7	`consentPage()`：自定义同意页，用于将资源所有者重定向到设备验证请求流期间是否需要同意。`URI`

OAuth2DeviceVerificationEndpointConfigurer配置并将其注册到 OAuth2 授权服务器。是处理 OAuth2 设备验证请求（和同意）的设备。OAuth2DeviceVerificationEndpointFilterSecurityFilterChain@BeanOAuth2DeviceVerificationEndpointFilterFilterSpring中文文档

OAuth2DeviceVerificationEndpointFilter配置了以下默认值：Spring中文文档

AuthenticationConverter— A 由和组成。DelegatingAuthenticationConverterOAuth2DeviceVerificationAuthenticationConverterOAuth2DeviceAuthorizationConsentAuthenticationConverterSpring中文文档
AuthenticationManager— 由和组成。AuthenticationManagerOAuth2DeviceVerificationAuthenticationProviderOAuth2DeviceAuthorizationConsentAuthenticationProviderSpring中文文档
AuthenticationSuccessHandler— 处理“已验证”并将用户重定向到成功页面（）的 A。SimpleUrlAuthenticationSuccessHandlerOAuth2DeviceVerificationAuthenticationToken/?successSpring中文文档
AuthenticationFailureHandler— 使用与关联的并返回响应的内部实现。OAuth2ErrorOAuth2AuthenticationExceptionOAuth2ErrorSpring中文文档

1	`deviceVerificationRequestConverter()`：将尝试从中提取 OAuth2 设备验证请求（或同意）时使用的（预处理器）添加到或的实例中。`AuthenticationConverterHttpServletRequestOAuth2DeviceVerificationAuthenticationTokenOAuth2DeviceAuthorizationConsentAuthenticationToken`
2	`deviceVerificationRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证或的（主处理器）。`AuthenticationProviderOAuth2DeviceVerificationAuthenticationTokenOAuth2DeviceAuthorizationConsentAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`deviceVerificationResponseHandler()`：（后处理器）用于处理“经过身份验证”并指示资源所有者返回其设备。`AuthenticationSuccessHandlerOAuth2DeviceVerificationAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回错误响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`
7	`consentPage()`：自定义同意页，用于将资源所有者重定向到设备验证请求流期间是否需要同意。`URI`

OAuth2 令牌终结点

OAuth2TokenEndpointConfigurer提供自定义 OAuth2 令牌终结点的功能。它定义了扩展点，允许您自定义 OAuth2 访问令牌请求的预处理、主处理和后处理逻辑。Spring中文文档

OAuth2TokenEndpointConfigurer提供以下配置选项：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.tokenEndpoint(tokenEndpoint ->
			tokenEndpoint
				.accessTokenRequestConverter(accessTokenRequestConverter)   (1)
				.accessTokenRequestConverters(accessTokenRequestConvertersConsumer) (2)
				.authenticationProvider(authenticationProvider) (3)
				.authenticationProviders(authenticationProvidersConsumer)   (4)
				.accessTokenResponseHandler(accessTokenResponseHandler) (5)
				.errorResponseHandler(errorResponseHandler) (6)
		);

	return http.build();
}

1	`accessTokenRequestConverter()`：将尝试从中提取 OAuth2 访问令牌请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOAuth2AuthorizationGrantAuthenticationToken`
2	`accessTokenRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOAuth2AuthorizationGrantAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`accessTokenResponseHandler()`：用于处理和返回 `OAuth2AccessTokenResponse` 的（后处理器）。`AuthenticationSuccessHandlerOAuth2AccessTokenAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 OAuth2Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`

OAuth2TokenEndpointConfigurer配置并将其注册到 OAuth2 授权服务器。是处理 OAuth2 访问令牌请求的标记。OAuth2TokenEndpointFilterSecurityFilterChain@BeanOAuth2TokenEndpointFilterFilterSpring中文文档

支持的授权类型为、、和。authorization_coderefresh_tokenclient_credentialsurn:ietf:params:oauth:grant-type:device_codeSpring中文文档

OAuth2TokenEndpointFilter配置了以下默认值：Spring中文文档

AuthenticationConverter— A 由、、和组成。DelegatingAuthenticationConverterOAuth2AuthorizationCodeAuthenticationConverterOAuth2RefreshTokenAuthenticationConverterOAuth2ClientCredentialsAuthenticationConverterOAuth2DeviceCodeAuthenticationConverterSpring中文文档
AuthenticationManager— 由、、和组成的。AuthenticationManagerOAuth2AuthorizationCodeAuthenticationProviderOAuth2RefreshTokenAuthenticationProviderOAuth2ClientCredentialsAuthenticationProviderOAuth2DeviceCodeAuthenticationProviderSpring中文文档
AuthenticationSuccessHandler— 一个内部实现，用于处理并返回 .OAuth2AccessTokenAuthenticationTokenOAuth2AccessTokenResponseSpring中文文档
AuthenticationFailureHandler— 一个 .OAuth2ErrorAuthenticationFailureHandlerSpring中文文档

1	`accessTokenRequestConverter()`：将尝试从中提取 OAuth2 访问令牌请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOAuth2AuthorizationGrantAuthenticationToken`
2	`accessTokenRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOAuth2AuthorizationGrantAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`accessTokenResponseHandler()`：用于处理和返回 `OAuth2AccessTokenResponse` 的（后处理器）。`AuthenticationSuccessHandlerOAuth2AccessTokenAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 OAuth2Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`

OAuth2 令牌自检端点

OAuth2TokenIntrospectionEndpointConfigurer提供自定义 OAuth2 令牌自检端点的功能。它定义了扩展点，允许您自定义 OAuth2 自检请求的预处理、主处理和后处理逻辑。Spring中文文档

OAuth2TokenIntrospectionEndpointConfigurer提供以下配置选项：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.tokenIntrospectionEndpoint(tokenIntrospectionEndpoint ->
			tokenIntrospectionEndpoint
				.introspectionRequestConverter(introspectionRequestConverter)   (1)
				.introspectionRequestConverters(introspectionRequestConvertersConsumer) (2)
				.authenticationProvider(authenticationProvider) (3)
				.authenticationProviders(authenticationProvidersConsumer)   (4)
				.introspectionResponseHandler(introspectionResponseHandler) (5)
				.errorResponseHandler(errorResponseHandler) (6)
		);

	return http.build();
}

1	`introspectionRequestConverter()`：将尝试从中提取 OAuth2 自检请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOAuth2TokenIntrospectionAuthenticationToken`
2	`introspectionRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOAuth2TokenIntrospectionAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`introspectionResponseHandler()`：（后处理器）用于处理“已验证”并返回 OAuth2TokenIntrospection 响应。`AuthenticationSuccessHandlerOAuth2TokenIntrospectionAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 OAuth2Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`

OAuth2TokenIntrospectionEndpointConfigurer配置并将其注册到 OAuth2 授权服务器。是处理 OAuth2 自检请求的。OAuth2TokenIntrospectionEndpointFilterSecurityFilterChain@BeanOAuth2TokenIntrospectionEndpointFilterFilterSpring中文文档

OAuth2TokenIntrospectionEndpointFilter配置了以下默认值：Spring中文文档

AuthenticationConverter— 一个 .OAuth2TokenIntrospectionAuthenticationConverterSpring中文文档
AuthenticationManager— 由 .AuthenticationManagerOAuth2TokenIntrospectionAuthenticationProviderSpring中文文档
AuthenticationSuccessHandler— 处理“已验证”并返回响应的内部实现。OAuth2TokenIntrospectionAuthenticationTokenOAuth2TokenIntrospectionSpring中文文档
AuthenticationFailureHandler— 一个 .OAuth2ErrorAuthenticationFailureHandlerSpring中文文档

1	`introspectionRequestConverter()`：将尝试从中提取 OAuth2 自检请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOAuth2TokenIntrospectionAuthenticationToken`
2	`introspectionRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOAuth2TokenIntrospectionAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`introspectionResponseHandler()`：（后处理器）用于处理“已验证”并返回 OAuth2TokenIntrospection 响应。`AuthenticationSuccessHandlerOAuth2TokenIntrospectionAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 OAuth2Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`

OAuth2 令牌吊销终结点

OAuth2TokenRevocationEndpointConfigurer提供自定义 OAuth2 令牌吊销终结点的功能。它定义了扩展点，允许您自定义 OAuth2 吊销请求的预处理、主处理和后处理逻辑。Spring中文文档

OAuth2TokenRevocationEndpointConfigurer提供以下配置选项：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.tokenRevocationEndpoint(tokenRevocationEndpoint ->
			tokenRevocationEndpoint
				.revocationRequestConverter(revocationRequestConverter) (1)
				.revocationRequestConverters(revocationRequestConvertersConsumer)   (2)
				.authenticationProvider(authenticationProvider) (3)
				.authenticationProviders(authenticationProvidersConsumer)   (4)
				.revocationResponseHandler(revocationResponseHandler)   (5)
				.errorResponseHandler(errorResponseHandler) (6)
		);

	return http.build();
}

1	`revocationRequestConverter()`：将尝试从中提取 OAuth2 吊销请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOAuth2TokenRevocationAuthenticationToken`
2	`revocationRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOAuth2TokenRevocationAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`revocationResponseHandler()`：用于处理“已验证”并返回 OAuth2 吊销响应的（后处理器）。`AuthenticationSuccessHandlerOAuth2TokenRevocationAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 OAuth2Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`

OAuth2TokenRevocationEndpointConfigurer配置并将其注册到 OAuth2 授权服务器。是处理 OAuth2 吊销请求的。OAuth2TokenRevocationEndpointFilterSecurityFilterChain@BeanOAuth2TokenRevocationEndpointFilterFilterSpring中文文档

OAuth2TokenRevocationEndpointFilter配置了以下默认值：Spring中文文档

AuthenticationConverter— 一个 .OAuth2TokenRevocationAuthenticationConverterSpring中文文档
AuthenticationManager— 由 .AuthenticationManagerOAuth2TokenRevocationAuthenticationProviderSpring中文文档
AuthenticationSuccessHandler— 处理“经过身份验证”并返回 OAuth2 吊销响应的内部实现。OAuth2TokenRevocationAuthenticationTokenSpring中文文档
AuthenticationFailureHandler— 一个 .OAuth2ErrorAuthenticationFailureHandlerSpring中文文档

1	`revocationRequestConverter()`：将尝试从中提取 OAuth2 吊销请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOAuth2TokenRevocationAuthenticationToken`
2	`revocationRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOAuth2TokenRevocationAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`revocationResponseHandler()`：用于处理“已验证”并返回 OAuth2 吊销响应的（后处理器）。`AuthenticationSuccessHandlerOAuth2TokenRevocationAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 OAuth2Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`

OAuth2 授权服务器元数据终结点

OAuth2AuthorizationServerMetadataEndpointConfigurer提供自定义 OAuth2 授权服务器元数据终结点的功能。它定义了一个扩展点，用于自定义 OAuth2 授权服务器元数据响应。Spring中文文档

OAuth2AuthorizationServerMetadataEndpointConfigurer提供以下配置选项：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.authorizationServerMetadataEndpoint(authorizationServerMetadataEndpoint ->
			authorizationServerMetadataEndpoint
				.authorizationServerMetadataCustomizer(authorizationServerMetadataCustomizer));   (1)

	return http.build();
}

1	`authorizationServerMetadataCustomizer()`：提供对授权服务器配置的声明的访问权限。`ConsumerOAuth2AuthorizationServerMetadata.Builder`

OAuth2AuthorizationServerMetadataEndpointConfigurer配置并将其注册到 OAuth2 授权服务器。是返回 OAuth2AuthorizationServerMetadata 响应的响应。OAuth2AuthorizationServerMetadataEndpointFilterSecurityFilterChain@BeanOAuth2AuthorizationServerMetadataEndpointFilterFilterSpring中文文档

1	`authorizationServerMetadataCustomizer()`：提供对授权服务器配置的声明的访问权限。`ConsumerOAuth2AuthorizationServerMetadata.Builder`

JWK 设置端点

OAuth2AuthorizationServerConfigurer提供对 JWK Set 端点的支持。Spring中文文档

OAuth2AuthorizationServerConfigurer配置并将其注册到 OAuth2 授权服务器。是返回 JWK 集的。NimbusJwkSetEndpointFilterSecurityFilterChain@BeanNimbusJwkSetEndpointFilterFilterSpring中文文档

仅当注册了 a 时，才会配置 JWK 集端点。JWKSource<SecurityContext>@Bean

OpenID Connect 1.0 提供程序配置端点

OidcProviderConfigurationEndpointConfigurer提供自定义 OpenID Connect 1.0 提供程序配置端点的功能。它定义了一个扩展点，用于自定义 OpenID 提供程序配置响应。Spring中文文档

OidcProviderConfigurationEndpointConfigurer提供以下配置选项：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.oidc(oidc ->
			oidc
				.providerConfigurationEndpoint(providerConfigurationEndpoint ->
					providerConfigurationEndpoint
						.providerConfigurationCustomizer(providerConfigurationCustomizer)   (1)
				)
		);

	return http.build();
}

1	`providerConfigurationCustomizer()`：提供对 OpenID 提供程序配置的声明的访问权限。`ConsumerOidcProviderConfiguration.Builder`

OidcProviderConfigurationEndpointConfigurer配置并将其注册到 OAuth2 授权服务器。是返回 OidcProviderConfiguration 响应的响应。OidcProviderConfigurationEndpointFilterSecurityFilterChain@BeanOidcProviderConfigurationEndpointFilterFilterSpring中文文档

1	`providerConfigurationCustomizer()`：提供对 OpenID 提供程序配置的声明的访问权限。`ConsumerOidcProviderConfiguration.Builder`

OpenID Connect 1.0 注销端点

OidcLogoutEndpointConfigurer提供自定义 OpenID Connect 1.0 注销端点的功能。它定义了扩展点，允许您自定义 RP 发起的注销请求的预处理、主处理和后处理逻辑。Spring中文文档

OidcLogoutEndpointConfigurer提供以下配置选项：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.oidc(oidc ->
			oidc
				.logoutEndpoint(logoutEndpoint ->
					logoutEndpoint
						.logoutRequestConverter(logoutRequestConverter) (1)
						.logoutRequestConverters(logoutRequestConvertersConsumer)   (2)
						.authenticationProvider(authenticationProvider) (3)
						.authenticationProviders(authenticationProvidersConsumer)   (4)
						.logoutResponseHandler(logoutResponseHandler)   (5)
						.errorResponseHandler(errorResponseHandler) (6)
				)
		);

	return http.build();
}

1	`logoutRequestConverter()`：将尝试从中提取注销请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOidcLogoutAuthenticationToken`
2	`logoutRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOidcLogoutAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`logoutResponseHandler()`：用于处理“已验证”并执行注销的（后处理器）。`AuthenticationSuccessHandlerOidcLogoutAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回错误响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`

OidcLogoutEndpointConfigurer配置并将其注册到 OAuth2 授权服务器。用于处理 RP 发起的注销请求并执行最终用户的注销。OidcLogoutEndpointFilterSecurityFilterChain@BeanOidcLogoutEndpointFilterFilterSpring中文文档

OidcLogoutEndpointFilter配置了以下默认值：Spring中文文档

AuthenticationConverter— 一个 .OidcLogoutAuthenticationConverterSpring中文文档
AuthenticationManager— 由 .AuthenticationManagerOidcLogoutAuthenticationProviderSpring中文文档
AuthenticationSuccessHandler— 处理“已验证”并执行注销的内部实现。OidcLogoutAuthenticationTokenSpring中文文档
AuthenticationFailureHandler— 使用与关联的并返回响应的内部实现。OAuth2ErrorOAuth2AuthenticationExceptionOAuth2ErrorSpring中文文档

OidcLogoutAuthenticationProvider使用 SessionRegistry 查找与请求注销的最终用户关联的实例。SessionInformation

OidcClientInitiatedLogoutSuccessHandler是 Spring Security 的 OAuth2 客户端支持中用于配置 OpenID Connect 1.0 RP 启动的注销的相应配置。

1	`logoutRequestConverter()`：将尝试从中提取注销请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOidcLogoutAuthenticationToken`
2	`logoutRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOidcLogoutAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`logoutResponseHandler()`：用于处理“已验证”并执行注销的（后处理器）。`AuthenticationSuccessHandlerOidcLogoutAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回错误响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`

OidcLogoutAuthenticationProvider使用 SessionRegistry 查找与请求注销的最终用户关联的实例。SessionInformation

OidcClientInitiatedLogoutSuccessHandler是 Spring Security 的 OAuth2 客户端支持中用于配置 OpenID Connect 1.0 RP 启动的注销的相应配置。

OpenID Connect 1.0 UserInfo 端点

OidcUserInfoEndpointConfigurer提供自定义 OpenID Connect 1.0 UserInfo 终结点的功能。它定义扩展点，用于自定义 UserInfo 请求的预处理、主处理和后处理逻辑。Spring中文文档

OidcUserInfoEndpointConfigurer提供以下配置选项：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.oidc(oidc ->
			oidc
				.userInfoEndpoint(userInfoEndpoint ->
					userInfoEndpoint
						.userInfoRequestConverter(userInfoRequestConverter) (1)
						.userInfoRequestConverters(userInfoRequestConvertersConsumer) (2)
						.authenticationProvider(authenticationProvider) (3)
						.authenticationProviders(authenticationProvidersConsumer) (4)
						.userInfoResponseHandler(userInfoResponseHandler) (5)
						.errorResponseHandler(errorResponseHandler) (6)
						.userInfoMapper(userInfoMapper) (7)
				)
		);

	return http.build();
}

1	`userInfoRequestConverter()`：将尝试从中提取 UserInfo 请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOidcUserInfoAuthenticationToken`
2	`userInfoRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOidcUserInfoAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`userInfoResponseHandler()`：用于处理“已验证”并返回 UserInfo 响应的（后处理器）。`AuthenticationSuccessHandlerOidcUserInfoAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 UserInfo Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`
7	`userInfoMapper()`：用于从的实例中提取声明。`FunctionOidcUserInfoAuthenticationContextOidcUserInfo`

OidcUserInfoEndpointConfigurer配置并将其注册到 OAuth2 授权服务器。是处理 UserInfo 请求并返回 OidcUserInfo 响应的。OidcUserInfoEndpointFilterSecurityFilterChain@BeanOidcUserInfoEndpointFilterFilterSpring中文文档

OidcUserInfoEndpointFilter配置了以下默认值：Spring中文文档

AuthenticationConverter— 一个内部实现，从中获取并创建一个 with the principal。AuthenticationSecurityContextOidcUserInfoAuthenticationTokenSpring中文文档
AuthenticationManager— 由组成，它与内部实现相关联，该实现根据授权期间请求的范围从 ID 令牌中提取标准声明。AuthenticationManagerOidcUserInfoAuthenticationProvideruserInfoMapperSpring中文文档
AuthenticationSuccessHandler— 处理“已验证”并返回响应的内部实现。OidcUserInfoAuthenticationTokenOidcUserInfoSpring中文文档
AuthenticationFailureHandler— 使用与关联的并返回响应的内部实现。OAuth2ErrorOAuth2AuthenticationExceptionOAuth2ErrorSpring中文文档

可以通过提供 OAuth2TokenCustomizer<JwtEncodingContext> 来自定义 ID 令牌。@Bean

OpenID Connect 1.0 UserInfo 端点是受 OAuth2 保护的资源，它需要在 UserInfo 请求中将访问令牌作为持有者令牌发送。以下示例演示如何启用 OAuth2 资源服务器配置：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	...

	http.oauth2ResourceServer(resourceServer -> resourceServer.jwt(Customizer.withDefaults()));

	return http.build();
}

@Bean
public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
	return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
}

A 是 OpenID Connect 1.0 UserInfo 终结点所必需的。JwtDecoder@Bean

指南操作方法：自定义 OpenID Connect 1.0 UserInfo 响应包含自定义 UserInfo 终结点的示例。

1	`userInfoRequestConverter()`：将尝试从中提取 UserInfo 请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOidcUserInfoAuthenticationToken`
2	`userInfoRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOidcUserInfoAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`userInfoResponseHandler()`：用于处理“已验证”并返回 UserInfo 响应的（后处理器）。`AuthenticationSuccessHandlerOidcUserInfoAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回 UserInfo Error 响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`
7	`userInfoMapper()`：用于从的实例中提取声明。`FunctionOidcUserInfoAuthenticationContextOidcUserInfo`

可以通过提供 OAuth2TokenCustomizer<JwtEncodingContext> 来自定义 ID 令牌。@Bean

A 是 OpenID Connect 1.0 UserInfo 终结点所必需的。JwtDecoder@Bean

指南操作方法：自定义 OpenID Connect 1.0 UserInfo 响应包含自定义 UserInfo 终结点的示例。

OpenID Connect 1.0 客户端注册端点

OidcClientRegistrationEndpointConfigurer提供自定义 OpenID Connect 1.0 客户端注册终结点的功能。它定义了扩展点，允许您自定义客户端注册请求或客户端读取请求的预处理、主处理和后处理逻辑。Spring中文文档

OidcClientRegistrationEndpointConfigurer提供以下配置选项：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	authorizationServerConfigurer
		.oidc(oidc ->
			oidc
				.clientRegistrationEndpoint(clientRegistrationEndpoint ->
					clientRegistrationEndpoint
						.clientRegistrationRequestConverter(clientRegistrationRequestConverter) (1)
						.clientRegistrationRequestConverters(clientRegistrationRequestConvertersConsumers) (2)
						.authenticationProvider(authenticationProvider) (3)
						.authenticationProviders(authenticationProvidersConsumer) (4)
						.clientRegistrationResponseHandler(clientRegistrationResponseHandler) (5)
						.errorResponseHandler(errorResponseHandler) (6)
				)
		);

	return http.build();
}

1	`clientRegistrationRequestConverter()`：将尝试从中提取客户端注册请求或客户端读取请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOidcClientRegistrationAuthenticationToken`
2	`clientRegistrationRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOidcClientRegistrationAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`clientRegistrationResponseHandler()`：（后处理器）用于处理“已验证”并返回客户端注册响应或客户端读取响应。`AuthenticationSuccessHandlerOidcClientRegistrationAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回客户端注册错误响应或客户端读取错误响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`

默认情况下，OpenID Connect 1.0 客户端注册端点处于禁用状态，因为许多部署不需要动态客户端注册。

OidcClientRegistrationEndpointConfigurer配置并将其注册到 OAuth2 授权服务器。是处理客户端注册请求并返回 OidcClientRegistration 响应的。OidcClientRegistrationEndpointFilterSecurityFilterChain@BeanOidcClientRegistrationEndpointFilterFilterSpring中文文档

OidcClientRegistrationEndpointFilter还处理客户端读取请求并返回 OidcClientRegistration 响应。

OidcClientRegistrationEndpointFilter配置了以下默认值：Spring中文文档

AuthenticationConverter— 一个 .OidcClientRegistrationAuthenticationConverterSpring中文文档
AuthenticationManager— 由和组成。AuthenticationManagerOidcClientRegistrationAuthenticationProviderOidcClientConfigurationAuthenticationProviderSpring中文文档
AuthenticationSuccessHandler— 处理“已验证”并返回响应的内部实现。OidcClientRegistrationAuthenticationTokenOidcClientRegistrationSpring中文文档
AuthenticationFailureHandler— 使用与关联的并返回响应的内部实现。OAuth2ErrorOAuth2AuthenticationExceptionOAuth2ErrorSpring中文文档

OpenID Connect 1.0 客户端注册端点是受 OAuth2 保护的资源，它要求在客户端注册（或客户端读取）请求中将访问令牌作为持有者令牌发送。Spring中文文档

客户端注册请求中的访问令牌需要 OAuth2 作用域。client.create

客户端读取请求中的访问令牌需要 OAuth2 作用域。client.read

以下示例演示如何启用 OAuth2 资源服务器配置：Spring中文文档

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer();
	http.apply(authorizationServerConfigurer);

	...

	http.oauth2ResourceServer(resourceServer -> resourceServer.jwt(Customizer.withDefaults()));

	return http.build();
}

@Bean
public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
	return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
}

OpenID Connect 1.0 客户端注册端点需要 A。JwtDecoder@Bean

1	`clientRegistrationRequestConverter()`：将尝试从中提取客户端注册请求或客户端读取请求时使用的（预处理器）添加到的实例中。`AuthenticationConverterHttpServletRequestOidcClientRegistrationAuthenticationToken`
2	`clientRegistrationRequestConverters()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationConverterAuthenticationConverter`
3	`authenticationProvider()`：添加用于验证 .`AuthenticationProviderOidcClientRegistrationAuthenticationToken`
4	`authenticationProviders()`：设置提供对默认和（可选）添加的访问权限，允许添加、删除或自定义特定 .`ConsumerListAuthenticationProviderAuthenticationProvider`
5	`clientRegistrationResponseHandler()`：（后处理器）用于处理“已验证”并返回客户端注册响应或客户端读取响应。`AuthenticationSuccessHandlerOidcClientRegistrationAuthenticationToken`
6	`errorResponseHandler()`：用于处理和返回客户端注册错误响应或客户端读取错误响应的（后处理器）。`AuthenticationFailureHandlerOAuth2AuthenticationException`

默认情况下，OpenID Connect 1.0 客户端注册端点处于禁用状态，因为许多部署不需要动态客户端注册。

OidcClientRegistrationEndpointFilter还处理客户端读取请求并返回 OidcClientRegistration 响应。

客户端注册请求中的访问令牌需要 OAuth2 作用域。client.create

客户端读取请求中的访问令牌需要 OAuth2 作用域。client.read

OpenID Connect 1.0 客户端注册端点需要 A。JwtDecoder@Bean